wcp/bin/v-add-firewall-chain at main · ghzhost/wcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
#!/bin/bash
# info: add firewall chain
# options: CHAIN [PORT] [PROTOCOL]
#
# example: v-add-firewall-chain CRM 5678 TCP
#
# This function adds new rule to system firewall

#----------------------------------------------------------#
#                Variables & Functions                     #
#----------------------------------------------------------#

# Argument definition
chain=$(echo "$1" | tr '[:lower:]' '[:upper:]')
port="$2"
port_ext="$2"
protocol="$3"
[ -z "$protocol" ] && protocol='TCP'
protocol=$(echo "$protocol" | tr '[:lower:]' '[:upper:]')

# Defining absolute path to iptables
iptables="/sbin/iptables"

# Includes
# shellcheck source=/etc/hestiacp/hestia.conf
source /etc/hestiacp/hestia.conf
# shellcheck source=/usr/local/hestia/func/main.sh
source "$HESTIA/func/main.sh"
# shellcheck source=/usr/local/hestia/func/firewall.sh
source "$HESTIA/func/firewall.sh"
# load config file
source_conf "$HESTIA/conf/hestia.conf"

# Get hestia port by reading nginx.conf
hestiaport=$(sed -ne "/listen/{s/.*listen[^0-9]*\([0-9][0-9]*\)[ \t]*ssl\;/\1/p;q}" "$HESTIA/nginx/conf/nginx.conf")
if [ -z "$hestiaport" ]; then
	hestiaport=8083
fi

#----------------------------------------------------------#
#                    Verifications                         #
#----------------------------------------------------------#

check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL]'
is_format_valid 'chain' 'port_ext' 'protocol'
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'

# Perform verification if read-only mode is enabled
check_hestia_demo_mode

#----------------------------------------------------------#
#                       Action                             #
#----------------------------------------------------------#

# Self heal iptables links
heal_iptables_links

# Checking known chains
case $chain in
	SSH) # Get ssh port (or ports) using v-list-sys-sshd-port.
		sshport="$($BIN/v-list-sys-sshd-port plain | sed ':a;N;$!ba;s/\n/,/g')"
		if [ -z "$sshport" ]; then
			sshport=22
		fi
		port=$sshport
		protocol=TCP
		;;
	FTP)
		port=21
		protocol=TCP
		;;
	MAIL)
		port='25,465,587,110,995,143,993'
		protocol=TCP
		;;
	DNS)
		port=53
		protocol=UDP
		;;
	WEB)
		port='80,443'
		protocol=TCP
		;;
	DB)
		port='3306,5432'
		protocol=TCP
		;;
	HESTIA)
		port=$hestiaport
		protocol=TCP
		;;
	RECIDIVE)
		port='1:65535'
		protocol=TCP
		;;
	*) check_args '2' "$#" 'CHAIN PORT' ;;
esac

# Adding chain
$iptables -N fail2ban-$chain 2> /dev/null
if [ $? -eq 0 ]; then
	$iptables -A fail2ban-$chain -j RETURN

	# Adding multiport module
	if [[ "$port" =~ ,|-|: ]]; then
		port_str="-m multiport --dports $port"
	else
		port_str="--dport $port"
	fi
	$iptables -I INPUT -p $protocol $port_str -j fail2ban-$chain
fi

# Preserving chain
chains="$HESTIA/data/firewall/chains.conf"
check_chain=""
[ -f "$chains" ] && check_chain=$(grep "CHAIN='$chain'" "$chains")
if [ -z "$check_chain" ]; then
	echo "CHAIN='$chain' PORT='$port' PROTOCOL='$protocol'" >> "$chains"
fi

# Changing permissions
[ -f "$chains" ] && chmod 660 "$chains"

#----------------------------------------------------------#
#                       Hestia                             #
#----------------------------------------------------------#

# Logging
$BIN/v-log-action "system" "Info" "Firewall" "Added service to firewall (Service: $chain, Port: $port, Protocol: $protocol)."
log_event "$OK" "$ARGUMENTS"

exit